Rust advisories / age
Vulnerability MediumRUSTSEC-2024-0433 · age
RUSTSEC-2024-0433: Malicious plugin names, recipients, or identities can cause arbitrary binary execution
Short answerA security vulnerability in the age crate: Malicious plugin names, recipients, or identities can cause arbitrary binary execution. GitHub rates it Medium. Fixed in 0.10.1, 0.11.1, 0.6.1, 0.7.2, 0.8.2, 0.9.3: update to a fixed version.
| Crate | age |
|---|---|
| Type | Vulnerability (code-execution) |
| Affected versions | From 0.6.0 before 0.6.1; from 0.7.0 before 0.7.2; from 0.8.0 before 0.8.2; from 0.9.0 before 0.9.3; from 0.10.0 before 0.10.1; from 0.11.0 before 0.11.1. |
| Fixed in | 0.10.1, 0.11.1, 0.6.1, 0.7.2, 0.8.2, 0.9.3 |
| Severity | Medium (GitHub rating) |
| Published | 2024-12-18 |
| Last changed | 2026-10-12 |
| Also known as | GHSA-4fg7-vxc8-qx5w, RUSTSEC-2024-0432 |
| Affected functions | age::plugin::Identity::default_for_plugin, age::plugin::Identity::from_str, age::plugin::IdentityPluginV1::new, age::plugin::Recipient::from_str, age::plugin::RecipientPluginV1::new |
What to do
- See which version you have:
cargo tree -i age(it also shows which of your dependencies pulls it in). - Update within your version requirement:
cargo update -p age. If the fix is a newer major or minor than your requirement allows, raise it in Cargo.toml (for exampleage = "0.9.3") or update the dependency that pulls it in. - Check again with
cargo audit, or paste your Cargo.lock into our Cargo.toml checker.
Details from the advisory
A plugin name containing a path separator may allow an attacker to execute an arbitrary binary.
Such a plugin name can be provided through an attacker-controlled input to the following age APIs when the plugin feature flag is enabled:
age::plugin::Identity::from_str(or equivalentlystr::parse::<age::plugin::Identity>())age::plugin::Identity::default_for_pluginage::plugin::IdentityPluginV1::new(theplugin_nameargument)age::plugin::Recipient::from_str(or equivalentlystr::parse::<age::plugin::Recipient>())age::plugin::RecipientPluginV1::new(theplugin_nameargument)
On UNIX systems, a directory matching age-plugin-* needs to exist in the working directory for the attack to succeed.
The binary is executed with a single flag, either --age-plugin=recipient-v1 or --age-plugin=identity-v1. The standard input includes the recipient or identity string, and the random file key (if encrypting) or the header of the file (if decrypting). The format is constrained by the age-plugin protocol.
An equivalent issue was fixed in the reference Go implementation of age, see advisory GHSA-32gq-x56h-299c.
Thanks to ⬡-49016 for reporting this issue.
References
- Package: crates.io/crates/age
- Advisory: rustsec.org/advisories/RUSTSEC-2024-0433.html
- Web: github.com/str4d/rage/commit/703152ecfa86f27952a35b57dd525ed39396a227
From the RustSec Advisory Database (CC0-1.0) via the OSV export, downloaded Oct 24, 2026. Severity score computed from the published CVSS vector.
Up next
Are you affected?Check your whole dependency treePaste Cargo.lock: every advisory, for your exact versions.Read it next →Also worth your time
Did this answer your question?